Description

Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1.

Remediation

References

https://github.com/Heartway/simditor/blob/master/simditor.docx

Related Vulnerabilities

CVE-2023-31580 Vulnerability in maven package com.networknt:light-oauth2

CVE-2020-8203 Vulnerability in maven package org.fujion.webjars:lodash

CVE-2021-42697 Vulnerability in maven package com.typesafe.akka:akka-http-core_2.13

CVE-2022-39353 Vulnerability in maven package org.webjars.npm:xmldom__xmldom

CVE-2020-26301 Vulnerability in npm package ssh2

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Third Party Advisory